According to an advisory issued by the US Computer Emergency Readiness Team (US CERT), anyone using the Wi-Fi Protected Access II (WPA 2) protocol is probably compromised. Users are advised to use a Wired Ethernet or VPN to protect themselves
Update: Users are advised to update their Wi-Fi devices as soon as companies start rolling out security patches. Using a VPN (Virtual Private Network) is also another way to encrypt your data and remain safe from the KRACK hack. 41 percent of Android devices are in danger of getting affected by some form of the attack.
A serious flaw in the Wi-Fi network security protocol — used in routers at home or office — has left almost every user at risk of data hacking and privacy breach, the US government has warned. According to an advisory issued by the US Computer Emergency Readiness Team (US CERT) late on Sunday, anyone using the Wi-Fi Protected Access II (WPA 2) protocol is probably compromised.
WPA2 has been used on all certified Wi-Fi hardware since 2006. The WPA (which is now obsolete) and WPA2 standards were created by the Wi-Fi Alliance industry group that promotes interoperability and security for the wireless LAN industry.
"US-CERT has become aware of several key management vulnerabilities in the four-way handshake of the Wi-Fi Protected Access II (WPA2) security protocol," the advisory read. "The impact of exploiting these vulnerabilities includes decryption, packet replay, TCP connection hijacking, HTTP content injection, and others." "Note that as protocol-level issues, most or all correct implementations of the standard will be affected," it added.
The Wi-Fi exploit is knows as "KRACK" — short for Key Reinstallation Attacks. According to The Guardian, security expert Mathy Vanhoef from Belgian university KU Leuven discovered the flaw in the wireless security protocol WPA2. The description of the bug on Vanhoef's KRACK website reads, "This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on. The attack works against all modern protected Wi-Fi networks. Depending on the network configuration, it is also possible to inject and manipulate data. For example, an attacker might be able to inject ransomware or other malware into websites."
The flaw affects operating systems and devices, including Android, Linux, Apple, Windows, MediaTek and others. An arstechnica.com report said the vast majority of existing access points aren't likely to be patched quickly, and some may not be patched at all.
"If initial reports are accurate that encryption bypass exploits are easy and reliable in the WPA2 protocol, it's likely attackers will be able to eavesdrop on nearby Wi-Fi traffic as it passes between computers and access points," the report added.
People are being advised to use a wired Ethernet connection rather than Wi-Fi, wherever possible. They are also advised to stop logging into websites or URLs that don't start with HTTPS.
Follow Us
IANS
Indo-Asian News Service View Full Profile
